Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20170321)

Security Fixes : - It was discovered that a remote attacker could leverage the generation of IPv6 atomic fragments to trigger the use of fragmentation in an arbitrary IPv6 flow in scenarios in which actual fragmentation of packets is not needed and could subsequently perform any type of a...

Moodle 2.x/3.x - SQL Injection

Exploit: Moodle SQL Injection via Object Injection Through User Preferences Date: April 6th, 2017 Exploit Author: Marko Belzetski Contact: [email protected] Vendor Homepage: https://moodle.org/ Version: 3.2 to 3.2.1, 3.1 to 3.1.4, 3.0 to 3.0.8, 2.7.0 to 2.7.18 and other unsupported versio...

Apple iOS legacy-diagnostics Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on vulnerable installations of Apple iOS. User interaction is required to exploit this vulnerability in that the target must connect to a WiFi access point. The specific flaw exists within the usage of the legacy-diagnostics protoc...

Out-of-bounds

The mx4200send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write...

CVE-2017-6462

Buffer overflow in the legacy Datum Programmable Time Server DPTS refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted /dev/datum device...

CVE-2016-10225

The sunxi-debug driver in Allwinner 3.4 legacy kernel for H3, A83T and H8 devices allows local users to gain root privileges by sending "rootmydevice" to /proc/sunxidebug/sunxidebug...

Buffer overflow

Buffer overflow in the legacy Datum Programmable Time Server DPTS refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted /dev/datum device...

CVE-2017-6451

The mx4200send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write...

CVE-2017-6451

CVE-2017-6451 affects the NTP legacy MX4200 refclock. The mx4200_send function mishandles the return value of snprintf, enabling a local attacker to trigger an out-of-bounds write and potentially execute arbitrary code. Affected: NTP before 4.2.8p10 and 4.3.x before 4.3.94. Mitigation/remediation...

CVE-2017-6462

CVE-2017-6462 affects ntp (ntpd) via a buffer overflow in the legacy Datum Programmable Time Server refclock driver (/dev/datum). The issue allows a local attacker to exploit crafted /dev/datum input to overflow a buffer and cause a denial of service or unspecified impact. Public sources corrobor...

CVE-2017-6462

Removed by vendor...

CVE-2017-6451

The mx4200send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write...

CVE-2016-10225

The sunxi-debug driver in Allwinner 3.4 legacy kernel for H3, A83T and H8 devices allows local users to gain root privileges by sending “rootmydevice” to /proc/sunxidebug/sunxidebug. Recent assessments: h00die at March 24, 2020 11:24pm UTC reported: This vulnerability is unbelievably easy to...

Important product security update: Virtuozzo PowerPanel RTM Hotfix 1 (7.0.1-346)

The new packages for Virtuozzo PowerPanel introducing a security fix and usability bug fixes. Vulnerability id: PP-312 Incorrect checking of locked VM accounts in Virtuozzo SDK allowed one to use any password to log in to Virtuozzo PowerPanel in the legacy mode for a VM with such a locked account...

DEBIAN-CVE-2017-5206

Firejail before 0.9.44.4, when running on a Linux kernel before 4.8, allows context-dependent attackers to bypass a seccomp-based sandbox protection mechanism via the --allow-debuggers argument...

CVE-2017-6451

A vulnerability was found in NTP, in the legacy MX4200 refclock implementation. If this refclock was compiled in and used, an attacker may be able to induce stack overflow, leading to a crash or potential code execution. Mitigation Properly monitor your ntpd instances, and auto-restart ntpd witho...

CVE-2017-7214

An issue was discovered in exceptionwrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens...

Authorization

An issue was discovered in exceptionwrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens...

UBUNTU-CVE-2017-7214

An issue was discovered in exceptionwrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens...

CVE-2017-7214

An issue was discovered in exceptionwrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens...